Source-level case research tagged Lazarus.
A source-level and on-chain reconstruction of the Bybit cold-wallet heist: the tampered Safe{Wallet} JavaScript, the delegatecall storage overwrite, and the full transaction trail.